Maven settings via SSO?

7
votes

I've got some developers who are unhappy about storing their LDAP username/passwords in settings.xml in order to access Nexus. Their unhappiness is partly FUD, but also the inconvenience of having to re-encrypt the password whenever their LDAP password expires (which is relatively frequent here).

Is there any way at all to get Maven to use SSO / LDAP instead? The artifact repository we're using is Nexus, and the web front-end of that does use SSO already.

2
mavensingle-sign-onnexus
User token as Mark mentions does not survive username/password changes like mentioned by RCross. However there is support for the user token to be automatically inserted into the settings.xml that can be downloaded from Nexus. So your password change process would 1. change SSO password, 2. reset user token in Nexus 3. get new settings.xml by calling the settings download goal of the nexus maven plugin. We are still looking at improving that more but ultimately a strict security process is work to deal with. - Manfred Moser
The main advantage with user token is that the ldap username and password can not be deciphered from the token at all so the security concern of a password on the disc now concerns Nexus only and not the whole SSO system. - Manfred Moser

2 Answers

1
votes

You can enable encryption in the settings.xml file so that it's not sitting there in plain text as well.

http://maven.apache.org/guides/mini/guide-encryption.html#How_to_encrypt_server_passwords

0
votes

The latest revision of Nexus has enabled a new security token feature to address this concern. I haven't used it yet, but it's documented here: